Each of many embedded system microcomputers has a built in flash ROM (flash memory) and a RAM. Programs are stored in the built in flash ROM. A CPU reads instruction codes from the flash ROM and performs them. Capacity of the RAM is smaller than the flash ROM and the CPU cannot copy (download) all of the programs on the RAM and perform them. When function which rewrites a program on the flash ROM to a new version program is provided, it is necessary that a program for rewriting is also stored on the flash ROM. In the flash ROM, programs which perform functions as an original product and a program (flash loader. Hereinafter, referred as to “loader”.) to rewrite the flash ROM are stored as the so-called firmware.
When the firmware is updated to new version firmware, the firmware is imported by method such as serial communication from outside of the microcomputer and it is written in the flash ROM. The flash ROM cannot be rewritten by the loader which is written on the flash ROM (since the loader is rewritten in middle of execution). Typically, the loader in the firmware is copied on the RAM and the instruction codes are read from the RAM and executed (for example, see JP 2016-103261 A). As described above, capacity of the built in RAM is small and capacity that the loader can be copied is required. However, it is difficult to secure the further RAM for work. Therefore, in serial communication, the firmware is input from small address of the flash ROM in order, and is written to the flash ROM in this order.
When the flash ROM is being rewritten, rewriting is interrupted by power supply cut or any abnormality, incomplete, namely, abnormal program is written in the flash ROM, and a device becomes inoperable. To prevent this, when the flash ROM is being rewritten, a mark which indicates rewriting is marked in somewhere of the flash ROM (or, a mark is marked by intentionally setting a part of the flash ROM to delete state). And, when activating a microcomputer, the microcomputer confirms the mark which indicates rewriting, judges that rewriting is interrupted when being rewritten if there is the mark, copies the loader to the RAM, executes, and performs rewriting of the firmware again. Thus, the device returns (recovery activation).
However, when the loader of the flash ROM is being rewritten, rewriting is interrupted by power supply cut or the like and the loader is broke state. For this reason, the firmware cannot be rewritten again and the device cannot return. To prevent this, there is a method that one is always normal by setting the flash ROM to twice capacity and rewriting the firmware alternately. It is necessary that capacity of the flash ROM is twice in this case. Further, as illustrated in FIG. 14, a microcomputer which has function which replaces small capacity block that the loader enters to the other block and can always store any one of new loader or old loader exists. However, all of the microcomputers do not have the above described function. There is a case where the loader is not stored because the replaced block is small capacity.
In a conventional device, when rewriting is interrupted when the loader is being rewritten, there is a possibility that the firmware cannot be recovered.